An updated lha package is available for Fedora Core 1
---------------------------------------------------------------------
Fedora Update Notification
FEDORA-2004-294
2004-09-08
---------------------------------------------------------------------
Product : Fedora Core 1
Name : lha
Version : 1.14i
Release : 12.2
Summary : An archiving and compression utility for LHarc format
archives.
Description :
LHA is an archiving and compression utility for LHarc format archives. LHA is mostly used in the DOS world, but can be used under Linux to extract DOS files from LHA archives.
Install the lha package if you need to extract DOS files from LHA archives.
---------------------------------------------------------------------
Update Information:
Lukasz Wojtow discovered a stack-based buffer overflow in all versions of lha up to and including version 1.14. A carefully created archive could allow an attacker to execute arbitrary code when a victim extracts or tests the archive. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0769 to this issue.
Buffer overflows were discovered in the command line processing of all versions of lha up to and including version 1.14. If a malicious user can trick a victim into passing a specially crafted command line to the lha command, it is possible that arbitrary code could be executed. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CAN-2004-0771 and CAN-2004-0694 to these issues.
Thomas Biege discovered a shell meta character command execution vulnerability in all versions of lha up to and including 1.14. An attacker could create a directory with shell meta characters in its name which could lead to arbitrary command execution. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0745 to this issue.
Users of lha should update to this updated package
---------------------------------------------------------------------
* Tue Sep 07 2004 Than Ngo than@redhat.com 1.14i-12.2
- security vulnerabilities CAN-2004-0769, CAN-2004-0771, CAN-2004-0694, CAN-2004-0745
---------------------------------------------------------------------
This update can be downloaded from:
http://download.fedora.redhat.com/pub/fedora/linux/core/updates/1/
4c8e03b8489c398e6f01c9c26e76a956 SRPMS/lha-1.14i-12.2.src.rpm
170bcabffe4609754eac38e4cab8b592 x86_64/lha-1.14i-12.2.x86_64.rpm
571754fe612bce9f0119dec63049dbca
x86_64/debug/lha-debuginfo-1.14i-12.2.x86_64.rpm
6b0f4909ea0753a01a2e29319348240d i386/lha-1.14i-12.2.i386.rpm
db44f0f1eeb45ebbbd0f39e079593879
i386/debug/lha-debuginfo-1.14i-12.2.i386.rpm
This update can also be installed with the Update Agent; you can launch the Update Agent with the 'up2date' command.
---------------------------------------------------------------------
Fedora Update Notification
FEDORA-2004-294
2004-09-08
---------------------------------------------------------------------
Product : Fedora Core 1
Name : lha
Version : 1.14i
Release : 12.2
Summary : An archiving and compression utility for LHarc format
archives.
Description :
LHA is an archiving and compression utility for LHarc format archives. LHA is mostly used in the DOS world, but can be used under Linux to extract DOS files from LHA archives.
Install the lha package if you need to extract DOS files from LHA archives.
---------------------------------------------------------------------
Update Information:
Lukasz Wojtow discovered a stack-based buffer overflow in all versions of lha up to and including version 1.14. A carefully created archive could allow an attacker to execute arbitrary code when a victim extracts or tests the archive. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0769 to this issue.
Buffer overflows were discovered in the command line processing of all versions of lha up to and including version 1.14. If a malicious user can trick a victim into passing a specially crafted command line to the lha command, it is possible that arbitrary code could be executed. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CAN-2004-0771 and CAN-2004-0694 to these issues.
Thomas Biege discovered a shell meta character command execution vulnerability in all versions of lha up to and including 1.14. An attacker could create a directory with shell meta characters in its name which could lead to arbitrary command execution. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0745 to this issue.
Users of lha should update to this updated package
---------------------------------------------------------------------
* Tue Sep 07 2004 Than Ngo than@redhat.com 1.14i-12.2
- security vulnerabilities CAN-2004-0769, CAN-2004-0771, CAN-2004-0694, CAN-2004-0745
---------------------------------------------------------------------
This update can be downloaded from:
http://download.fedora.redhat.com/pub/fedora/linux/core/updates/1/
4c8e03b8489c398e6f01c9c26e76a956 SRPMS/lha-1.14i-12.2.src.rpm
170bcabffe4609754eac38e4cab8b592 x86_64/lha-1.14i-12.2.x86_64.rpm
571754fe612bce9f0119dec63049dbca
x86_64/debug/lha-debuginfo-1.14i-12.2.x86_64.rpm
6b0f4909ea0753a01a2e29319348240d i386/lha-1.14i-12.2.i386.rpm
db44f0f1eeb45ebbbd0f39e079593879
i386/debug/lha-debuginfo-1.14i-12.2.i386.rpm
This update can also be installed with the Update Agent; you can launch the Update Agent with the 'up2date' command.
